Explainable AI-driven edge–cloud framework for cluster-based predictive cyber threat detection in IIoT-enabled internet of vehicles

Tamara Kokenovna Zhukabayeva, Zulfiqar Ahmad, Nurdaulet Karabayev, Dilaram Baumuratova, Elhadj Benkhelifa

Discover Artificial Intelligence, 2026

Full text Open access: Gold Metadata (CSL-JSON)
DOI 10.1007/s44163-026-02116-z
Data confidence 70 medium
How this score is calculated

It is built from checkable properties of the record itself: whether the article has a DOI, how many independent sources confirmed its data, whether the required fields are filled in, and how recent the latest confirmation is. Disagreement between sources and a missing identifier lower it. A value of 80 or above means the record was published without further checking; 60 to 79 means it is published at reduced confidence, with a manual check advisable. A record verified by an editor by hand is never pushed below 90 by a recalculation. This scores our data about the article, not the article itself.

Abstract

Industrial Internet of Things (IIoT) networks have greatly expanded with emerging environments, including Internet of Vehicles (IoV), and the need to ensure real-time cybersecurity has become much more complex. We propose a robust and explainable cybersecurity framework for IoV in IIoT Cyber-Physical Systems (CPS), in which we perform implementation and validation using the RT-IoT2022 (Real-Time Internet of Things) dataset. The framework includes clustering techniques for pattern discovery, predictive modeling for threat detection, Explainable Artificial Intelligence (XAI) for interpretability enhancement, and a cloud–edge integration concept for efficient and scalable processing. The behavior patterns in the network traffic were discovered to be clustered, which helped in early anomalous behavior detection. Gaussian Mixture Modeling (GMM) achieved a Silhouette Score of 0.53 and an ARI of 0.75, indicating better alignment with the true labels. Decision Tree (DT), K-Nearest Neighbors (KNN), and Light Gradient Boosting Machine (LightGBM), as well as Multi-Layer Perceptron (MLP) classifiers, were used to carry out predictive analysis. Among these, DT attained the highest classification accuracy of 99.43%, followed by KNN (99.25%), MLP (98.90%), and LightGBM (81.03%). The DT, KNN, and MLP models achieved consistently high precision, recall, and F1-scores across most attack classes, whereas LightGBM exhibited comparatively lower performance for several classes. In order to maintain transparency in decision-making, LIME (Local Interpretable Model-agnostic Explanations) was used to get feature-level insights into the predictions of each model. The LIME analysis shows that each model relied on several features and decision-making logic, such as threshold-based splits in DT, feature similarity in KNN, volume-based patterns in LightGBM, and non-linear interactions in MLP. The proposed framework combines cloud–edge processing, high detection accuracy, early threat identification, and explainability, and thus is a powerful solution for real-time IIoT cybersecurity applications.